CVE-2026-40748: WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the Kids Gift Shop WordPress theme, versions 0.5.4 and earlier. The flaw is reachable over the network and requires only a low-privilege subscriber-level account, making it accessible to any registered user on the affected site. Successful exploitation allows an attacker to upload and execute arbitrary files on the server, enabling full remote code execution with the potential for complete confidentiality, integrity, and availability impact across the hosting environment. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS traffic.

• AuthenticationRequired

  A low-privilege account (subscriber level or equivalent) is sufficient; no administrative credentials are needed to trigger the file upload.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the upload can be performed directly against the application.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental dependencies to succeed.

Blast Radius

• Attacker uploads and executes arbitrary server-side code, gaining a remote shell on the hosting container or server.
• With a scope-changed (S:C) rating, a successful attacker reads all files and environment variables accessible to the web server process, including database credentials and API keys stored in WordPress configuration files.
• Attacker modifies or deletes theme files, plugins, database content, and any other assets writable by the web server process.
• Attacker crashes or renders the WordPress application unavailable by overwriting critical files or exhausting server resources through uploaded payloads.